Google Auth
Login or auto-register with a Google account.
The frontend sends either a Google ID-token (from @react-oauth/google’s
<GoogleLogin> credential field) or an OAuth access-token. The backend
tries ID-token verification first, then falls back to Google’s userinfo
endpoint, because different frontend libraries produce different token types.
Account linking logic:
- Lookup by
google_id— existing Google-linked account. - Lookup by email — link a pre-existing local account to Google if the email addresses match and the local account has no Google ID yet.
- Auto-create a new account using the email prefix as the username base.
Args: payload: Google credential (ID-token or access-token) and reCAPTCHA token. request: The raw HTTP request for IP extraction. db: Database session.
Returns:
A TokenResponse with the JWT, expiry, and user profile.
Raises: HTTPException 400: CAPTCHA failure or unverified Google email. HTTPException 401: Invalid Google credential. HTTPException 403: Account disabled. HTTPException 409: Email already linked to a different Google account. HTTPException 501: Google OAuth not configured on this server.